Drive C automatically shared (no admin share!)

[werth.david]

Hey there,

I recently realized that on my computer the drive C is shared within the network (not C$ admin share). I was wondering about the share-icon on drive C when I opened "My Computer". So I disabled the share and forgot about it.
Somehow Windows or a program is re-creating that network share after a while (couldn't observe a pattern yet...). Sometimes when I disable it, it says that there are still open connections. In the computer management panel under sessions I can't find further information...

Does anybody know what might cause the issue?

I don't consider it as a big threat, the computer is behind a router with no port-forwarding but it's weird. The OS is quite "clean", I don't have any "suspicious programs" installed and also no free/adware programs that come with some bundled crap.

Machine:
Dell XPS 9560
Windows 10 Pro 1809
Windows Defender enabled

 

[johnbl]

you might start cmd.exe or powershell as an admin then type
net.exe share
net.exe session /list
net.exe file


this will give you the username and the name of the resouce it is connected to on the share.

you can use the
net share mysharename /delete
to delete the share. it should ask if you want to force close connections.

Hey there,

I recently realized that on my computer the drive C is shared within the network (not C$ admin share). I was wondering about the share-icon on drive C when I opened "My Computer". So I disabled the share and forgot about it.
Somehow Windows or a program is re-creating that network share after a while (couldn't observe a pattern yet...). Sometimes when I disable it, it says that there are still open connections. In the computer management panel under sessions I can't find further information...

Does anybody know what might cause the issue?

I don't consider it as a big threat, the computer is behind a router with no port-forwarding but it's weird. The OS is quite "clean", I don't have any "suspicious programs" installed and also no free/adware programs that come with some bundled crap.

Machine:
Dell XPS 9560
Windows 10 Pro 1809
Windows Defender enabled

 

[werth.david]

So when I posted the question I manually disabled the share. Today it appeared again... output as follows:

C:\WINDOWS\system32>net share
Name         Ressource                       Beschreibung
-------------------------------------------------------------------------------
IPC$                                         Remote-IPC
C$           C:\                             Standardfreigabe
ADMIN$       C:\WINDOWS                      Remoteverwaltung
C            C:\                             Zwischenspeicherung deaktiviert
Der Befehl wurde erfolgreich ausgeführt.

C:\WINDOWS\system32>net session /list
Es sind keine Einträge in der Liste.

C:\WINDOWS\system32>net file
Es sind keine Einträge in der Liste.

Nobody is connected but the share is there again!?

 

[Peter Martin]

you might be compromised. did you run any malwarebytes scans to see if it finds anything?

 

[werth.david]

Yessir! Nothing found...

 

[werth.david]

Now it shows something!

C:\WINDOWS\system32>net sessions /list
Benutzername          David
Computer              10.0.75.2
Gastanmeldung         Nein
Clienttyp
Ruhezeit              00:10:40

That's the IP of my virtual LAN adapter that is used by Docker.... It seems like Docker is creating that share!

 

[werth.david]

Ok wow... I closed Docker 4 Windows and removed the share.. After restarting Docker it is there again!
Thanks guy, I'll close this one and see what the Github page says...

 

[Peter Martin]

sweet, I was reading just now about how docker is causing that issue with others. you found it first.